| Summary: | lastlog does not work as non-root | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Stef Walter <stefw> |
| Component: | ostree | Assignee: | Colin Walters <walters> |
| Status: | CLOSED CURRENTRELEASE | QA Contact: | atomic-bugs <atomic-bugs> |
| Severity: | unspecified | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 7.2 | CC: | dperpeet, dwalsh, jpazdziora, lsm5, miabbott, mvollmer, walters |
| Target Milestone: | rc | Keywords: | Extras |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | Bug Fix | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-29 15:26:47 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
|
Description
Stef Walter
2016-03-15 09:09:44 UTC
For now, a non-root user hasn't a read permission on /var/log/lastlog file, if only root user can write /var/log/lastlog file, I'm not sure if it's information leakage to allow non-root to read /var/log/lastlog. [cloud-user@atomic-00 ~]$ sudo atomic host status TIMESTAMP (UTC) VERSION ID OSNAME REFSPEC * 2016-03-29 20:52:18 7.2.3 d620e84186 rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard 2016-03-11 19:31:01 7.2.3 f6f9c97816 rhel-atomic-host rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard [cloud-user@atomic-00 ~]$ rpm -q shadow-utils shadow-utils-4.1.5.1-18.el7.x86_64 [cloud-user@atomic-00 ~]$ sudo ls -l /var/log/lastlog ----------. 1 root root 292292 Apr 6 09:10 /var/log/lastlog [cloud-user@atomic-00 ~]$ lastlog /var/log/lastlog: Permission denied Why can a user read /var/log/lastlog on RHEL and Fedora but not on Atomic? Does Atomic have different requirements about sharing login information with non-root users? (In reply to Stef Walter from comment #3) > Why can a user read /var/log/lastlog on RHEL and Fedora but not on Atomic? > Does Atomic have different requirements about sharing login information with > non-root users? I just checked a RHEL system, yes, the non-root users should have a read permison for /var/log/lastlog, but I'm not sure if it's an design for Atomic Host, anyway, I think Daniel can give a authoritative answer. This seems like a bug. Having permissions of 000 means that even root can not read it, unless it has CAP_DAC_ADMIN. Lastlog info is not that valuable. Colin this looks like an Atomic host bug that got lost in the noise, I can't reproduce this with: | image | rhel-atomic-cloud-7.2-latest (936d1121-6a31-49d3-b308-a1d2c6d54c27) | Ok lets mark this as modified then i'll have this removed from the atomic errata. Thanks Colin ```$ rpm-ostree status
State: idle; auto updates disabled
Deployments:
* ostree://rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.8.0 (2020-03-27 12:03:52)
Commit: 0bbae7b8382b6228274909d26acf455738241115af3de44deac128348036f1ab
ostree://rhel-atomic-host-ostree:rhel-atomic-host/7/x86_64/standard
Version: 7.7.3 (2019-11-19 15:23:12)
Commit: e0ac32316936b7e138a2f9bea407bf20124f34f519e8f7147df3edc69ca86296
$ sudo ls -l /var/log/lastlog
-rw-r--r--. 1 root root 292292 Apr 29 15:17 /var/log/lastlog
$ lastlog
Username Port From Latest
root pts/2 Mon Feb 10 14:40:23 +0000 2020
cloud-user pts/0 ovpn-66-149.rdu2 Wed Apr 29 15:17:39 +0000 2020
bin **Never logged in**
daemon **Never logged in**
adm **Never logged in**
lp **Never logged in**
sync **Never logged in**
shutdown **Never logged in**
halt **Never logged in**
mail **Never logged in**
operator **Never logged in**
games **Never logged in**
ftp **Never logged in**
nobody **Never logged in**
dbus **Never logged in**
polkitd **Never logged in**
etcd **Never logged in**
tss **Never logged in**
avahi-autoipd **Never logged in**
rpc **Never logged in**
sssd **Never logged in**
dockerroot **Never logged in**
rpcuser **Never logged in**
nfsnobody **Never logged in**
kube **Never logged in**
sshd **Never logged in**
chrony **Never logged in**
systemd-network **Never logged in**
gluster **Never logged in**
ceph **Never logged in**
```
|